Personal Data Protection Notice

We value your privacy and are committed to the protection of your personal data. In line with the Personal Data Protection Act of Thailand 2019 (B.E. 2562) (“PDPA”, which includes a reference to any subsidiary legislation made thereunder and any amendment, modification or re-enactment thereof from time to time) and the export of personal data of the relevant individual outside of Thailand, this Personal Data Protection Notice (“PDP Notice”) describes what information we collect when you visit our Site and/or use the Platform (as defined hereinafter), how we process your personal data, the parties we disclose the data to and your rights relating to your personal data provided to us.

This PDP Notice should be read in conjunction with such terms and conditions in all other agreements between you and us (“Terms and Conditions”). In the event of any conflict or inconsistency between the provision of this PDP Notice and the Terms and Conditions, the provisions of the Terms and Conditions shall prevail to the fullest extent permissible by law. Any consent given pursuant to the Terms and Conditions in relation to personal data shall, subject to all applicable laws and regulations, survive death, incapacity, bankruptcy or insolvency of any such individual and the termination or expiration of the Terms and Conditions.

This PDP Notice supplements but does not supersede nor replace any other consents which may have been previously provided to us or any other rights of collection, use or disclosure under the Terms and Conditions nor does it affect any rights that we may have at law in connection with the collection, use and/or disclosure of the personal data.

In the course of your dealings with us, we may request that you provide data about yourself, your employees, your customers and/or your counterparties to enable us to enter into transaction. By visiting, accessing and/or using this Site, you agree to be bound by this PDP Notice and if you do not agree, please stop visiting this Site.

For the purposes of this PDP Notice, the expressions:

1. “CapBay”, “we”, “us” and “our” refers to, Bay Commerce (Thailand) Co. Ltd. (Registration No.: 0105566081443) and its Related Corporations and jointly controlled companies;
2. “personal data” and “processing” have the meaning ascribed to them in the PDPA (and the expression “process” shall therefore be construed accordingly);
3. “Related Corporations” means, in relation to a person, the power (whether by way of ownership of shares, proxy, contract, agency or otherwise), to (i) cast, or control the casting of, more than fifty per centum (50%) or more of the general voting rights in that person; (ii) the holding beneficially (directly or indirectly) of more than fifty per centum (50%) of the issued share capital (excluding preference shares) of that person; (iii) appoint or remove all, or the majority, of the directors or other equivalent officers of that person; or (iv) give directions with respect to the management and policies of that person with which the directors or other equivalent officers of that person are obliged to comply;
4. “Site” refers to this website, mobile applications and/or any other digital interfaces operated by us, as well as the services available on or provided through the Site, whether currently existing or developed in the future; and
5. “you” or “your” refers to each user of this Site, including any authorised representative acting on behalf of a company or organisation.

 A. What Kind of Personal Data We Collect
In order to enable us to deal with your inquiries (or inquiries from your organisation or company), open and operate an account for you (or your organisation or company) on the financing platforms which may be owned and/or operated by us (each a “Platform” and collectively the “Platforms”) and/or to generally provide you (or your organisation or company) with our products and services (including those offered through a Platform), we may need to process personal data about you.

Personal data refers to any information that relates directly or indirectly to you, from which you may be identified (including your images) and includes (without limitation) sensitive personal data and expressions of opinion about you.

Personal data which we may collect includes (without limitation) name as per identity card, preferred name, identification particulars, age, date of birth, identification issued by governmental authorities (e.g. national ID number, driver’s license number, passport number, foreign registration number, government officer card, household registration), copies and details of identification documents, contact details (such as residential and/or mailing address, email address and phone number), designation, employment history, bank account details, bank statement, transaction patterns, copy of credit card, credit card number, expiry date, loan application form, payment history and credit history, investment data, crowdfunding investment data, issuance of crowdfunding debenture data, history of investment activities, credit and references check, gender, race, nationality, marital status, occupation, title/salutation, commission or alleged commission of offence, activity performed on the Platform (whether collected through cookies and other technology, your registration and use of CapBay’s website (including the account registration, income, financing activity as well as personal, financial and social security details, authentication data such as passwords, your maiden name, PINs, signatures, e-signatures, facial and voice recognition data and fingerprints data), photographs and visual images, interaction data such as your voice recordings which have been interacted between us), marketing preferences, products and services you are interested in, reference or preference inference from your interaction with us, third party details provided by you (e.g. details of your family members, references, guarantors, contact person for debt collection, witnesses, beneficiaries or attorneys), financing activity as well as personal, financial and social security details, your personal opinions made known to us, information relating to your activities, habits, preferences and interests arising from your use of products and services of CapBay, our partners or vendors, other electronic data or information relating to you such as IP addresses, cookies, activity logs, online identifiers and location data through your usage of our products and services or as part of their delivery to you and any other information that may be relevant in order for us to provide our services to you.

B. When and How We Collect Your Personal Data

1. through your (or your organisation’s or company’s) relationship with us, such as when you access and/or use our Site and/or services, information provided via application forms, when using our products or services (or a product or service offered through a Platform), taking part in surveys, promotions and reviews, and enquiries about our products and/or services (or a product or service offered through a Platform);
2. through your verbal and written communications with us and/or our authorised agents;
3. from your call to our helpdesk or representatives;
4.  from any information that is supplied and/or collected when you visit our Site, such as your mobile device, IP address or from any information that is collected via cookies and any other similar technologies in our Site;
5. from a counterparty to whom you are providing (or involved, in any capacity, in providing) goods or services;
6.  third party background checks, any registered credit reporting agency, any financial institution, any regulatory authorities, any authority, central depository, depository agent or law enforcement agencies;
7. specifically for Platform users or Participants (as defined in the Platform Agreement) who have signed up with an introductory reference code or who have been introduced by an introducer or partner of CapBay, the user consents to its data on the Platform being used, processed, shared and distributed to the partner for any purpose pursuant to the performance of the agreement(s) between CapBay and the partner;
8. from third parties of which you have given your consent to disclose the personal data and / or where not otherwise restricted, or publicly available sources or registries;
9. from any analysis of the way you use and manage your account / facility with us; and

 from such other sources where you have given your consent for the disclosure of personal data relating to you, and/or where otherwise lawfully permitted.

C. What We May Use Your Personal Data For

We may collect, use, record, hold, store and/or process your personal data for the following purposes:

1. when it is necessary for the performance of a contract to which you are a party or to take steps upon your request before entering into any contractual relationship with you;
2. when we have to meet our legal obligations;
3. when it is necessary for in our/other’s legitimate interest;
4.  when performing a task for public interest or to exercise official authority;
5. when you consent to the processing of your personal data;
6. when it is necessary to prevent harms to a person’s life, body, or health.
7. in connection with an enquiry or application made on a Site (including, without limitation, to become a user of the Platform or for financing via a Platform);
8. to ascertain the eligibility or veracity of documents uploaded on a Platform and/or Site (including, without limitation, invoice and supporting documents);
9. in connection with any contract or arrangement entered or to be entered into between you (or your organisation or company) and us or a funder offering financing via a Platform (“Funder”);
10. to execute or facilitate the execution or performance of any financing document, arrangement or transaction;
11. to manage and maintain your (or your organisation or company’s) account(s) and facility(ies) with us;
12. to better understand the current and future needs as well as financial situation of an applicant of a Platform which you represent;
13. to manage our infrastructure, business operations and complying with internal policies and procedures;
14. to verify your identity for the purposes of providing and allowing access to our services;
15. to communicate advertising or marketing materials, whether directed to you or in general (including but not limited to, information on promotions and offers), to identify other products and/or services which might be of interest to you and to inform you about our products and/or services;
16. to support or improve our business, financial and risk monitoring, security, service quality, customisation strategies, planning, decision-making, assess financial, insurance or other risks;
17. in respect of users or participants of a Platform who have signed up with an introductory reference code or who have been introduced by our introducer or partner, sharing with such introducer or partner in connection with the event or promotion pursuant to which the introduction was made;
18. to transfer or assign our rights and duties under any governing terms and conditions between us and yourself;
19. to respond to your enquiries and complaints and to generally resolve disputes;
20. for the purpose of record-keeping in the ordinary course of our business;
21. to update, consolidate and improve the accuracy of our records;
22. to produce data, reports and statistics which have been anonymised or aggregated in a manner that does not identify you as an individual;
23. to conduct research surveys, design and improvement of our product, and trend analysis on various matters, including, without limitation, product development, statistical, security and testing purposes, and knowledge discovery in data and analysis of transactions with us;
24. in connection with financing agreements and/or the agreements in connection with a Platform including and not limited to a platform agreement, terms of services and/or our rules and policies with respect to the usage of a Platform (including, but not limited to, monitoring compliance and enforcement of rights);
25. the compliance and disclosure requirements of any governmental and/or quasi- governmental departments, agencies or regulatory and/or statutory bodies;
26. conducting credit checks, screenings or due diligence checks as may be required under applicable law, regulation or directive;
27. to maintain your credit history or risk related models for present and future references;
28. monitoring products and services provided by or made available through us;
29. complying with any legal obligation binding on us under any law, rule, regulation, by-law, order, guideline, directive, policy and such other requirements in force and as amended from time to time by any credit bureau or credit information sharing services of which we are a member or subscriber;
30. for financial reporting, regulatory reporting, management reporting, audit, compliance and risk management purposes;
31. in connection with performance of our duties and obligations when seeking consultancy or professional advice, including legal advice;
32. to transfer or assign any of our rights vis-à-vis you (or your organisation or company);
33. to conduct know your customer (KYC) procedures, customer due diligence (CDD) procedures, politically exposed persons (PEP) screening purposes, to check the data or to conduct background checks in relation to Notification of Capital Market Supervisory Board Tor Jor. 21/2562, anti-money laundering checks. and for to verify your identity, your signature and your location as well as to record your personal identification security question for mobile applications or websites;
34. to collect any debt due owing and to enforce and/or defend any of our rights;
35. to protect security and stability of CapBay, to enforce and/or defend any of CapBay’s interest, as and when necessary;
36. in the event of sale, transfer, merger, reorganization or similar event, to disclose and transfer your personal data to one or more third parties as part of that transaction;
37. for any other purpose that is required or permitted by any law, regulations, guidelines and/or relevant regulatory authorities; and
38. for all other purposes associated with any of the above or incidental to our business.

In the case of sensitive personal data or special categories of personal data under the applicable data protection laws, in addition to the lawful grounds above, we will process such data in accordance with any other additional requirements as prescribed by such data protection laws.

D. Disclosure of Personal Data

In carrying out one or more of the above purposes and/or by using our services and/or accessing this Site, you consent to us that your personal data may be disclosed to and processed by the following parties:

1. CapBay and its Related Corporations, as well as their respective directors, executives, employees, staff, representatives, contractors and agents;
2. a Funder or a potential Funder;
3. strategic / business partners with whom we have a relationship with for specific products and services;
4. your organisation or company whom you are representing in connection with the Platform or our products or services (or a product or service offered through a Platform);
5. our Related Corporations;
6. data centres or servers located worldwide for storage purposes;
7. any person to whom we are under an obligation to make disclosure under law, rule, regulation, by-law, order, guideline, directive, policy; any court and/or officer of the court; our auditors;
8. any credit bureau, credit reporting agencies, credit reference agencies, rating agencies and third-party due diligence database service providers;
9. companies and/or organisations that act as our agents, affiliates, service providers, business partners, professional advisers, other banks and/or financial institution, within or outside Thailand, where necessary;
10. companies and/or organisations that assist us in processing and/or otherwise fulfilling transactions or services that you have requested (whether on your own behalf or on behalf of your organisation or company);
11. companies and/or organisations that provide services to us in communicating our products and services (or a product or service offered through a Platform) to you;
12. any other person notified by you as authorised to give instructions or to use the account(s)/facility(ies) or products or services on your (or your organisation’s or company’s) behalf;
13. any third party as a result of any restructuring of facilities granted to you, sale of debts, transfer of rights granted by you (or your organisation or company) or the acquisition or sale of any company by us, provided that any recipient uses your information for the same purposes as it was originally supplied to us and/or used by us;
14. any guarantors or security providers for the facility(ies) granted to you;
15. any person intending to settle any moneys outstanding under the facility(ies) granted to you;
16. any rating agency, insurer or insurance broker or direct or indirect provider of credit protection;
17. law enforcement agencies, for the purpose of preventing and/or detecting crime, investigations and/or the apprehension or prosecution of offenders and/or protection of national security and/or any purpose that is required or authorized by or under any law, order or judgment of a court;
18. government bodies and agencies, to meet our legal and regulatory obligations;
19. any party authorised and/or consented by you; and
20. any person connected to the enforcement or preservation of any of rights under a financing agreement or arrangement or our rights under your agreement(s) with us,

subject to any laws (including regulations, guidelines and/or obligations) which apply to us (whether in or outside Thailand), the aforementioned third parties may be located outside of Thailand.

E. Accuracy of your Personal Data
You are responsible for ensuring that the personal data about yourself and any other person that you provide to us is accurate, complete and not misleading and that such personal data is kept up-to-date. This obligation is a condition to the provision of our products and/or services (or a product or service offered through a Platform) to you and/or any other person authorised or permitted by you or your organisation/company to use such products and/or services. You shall promptly keep us informed in the event that such personal data is inaccurate, incomplete, misleading or not up-to-date and you shall provide us the true, accurate, complete and updated data.

If you give us personal data about another person (for example where you are the designated person in charge (from an organisation or company), you confirm that you: (i) have notified the relevant individual of the purposes for which data will be collected, processed, used or disclosed; (ii) informed them to read this PDP Notice; (iii) have obtained such individual’s consent for, and hereby consents on behalf of such individual to, the collection, processing, use and disclosure of his/her personal data; (iv) have been authorised by such individual to provide such consent on his/her behalf; and (v) will immediately notify us upon becoming aware of the withdrawal by the relevant individual of his/her

F. What If You Do Not Provide Us with Your Personal Data?
Where indicated (for example in registration/application forms), it is obligatory to provide your personal data to us to enable us to process your application for our products and/or services (or a product or service offered through a Platform). Should you decline to provide such personal data, we may not be able to process such applications, or provide and/or continue to provide our products and/or services (or a product or service offered through a Platform).

G. Retention of Personal Data

We will retain any personal data supplied by you for as long as necessary for the duration of your (or your organisation’s or company’s) relationship with us, for such period as may be necessary to protect our interests as may be deemed necessary, where otherwise required by the law, regulatory requirement or demand and/or where required by our policies.

H. Security Measure
We take all steps reasonably necessary to ensure that your personal data is treated securely and in accordance with this PDP Notice. However, when you provide your information to us through our Platform and/or Site, or when you send us or ask us to send you any of your confidential information by email, the internet may not be secure. We are not responsible for any loss or unauthorised interception of information transmitted via the internet which is beyond our control.

This Site may contain links to third party websites. These websites are governed by their own privacy policies, and we are not responsible for the content, privacy and/or security of other websites.

I. Transfer of Your Personal Data to Places Outside Thailand
Your personal data may be transferred to and collected and/or used in jurisdictions other than Thailand, including, without limitation, (i) Malaysia; (ii) where any of our service providers or partners who are involved in providing part of our product and/or service is located; and (iii) any of our outsourced data storage or data processing services for and on behalf is located or has servers and/or related equipment outside Thailand.

We need to transfer the personal data in this way to carry out our contract with you, fulfill legal obligations, protect the public interests and/or for our legitimate interests.

By using our services or the Site and those of our partners or any website we link through to, you agree that your personal data may be processed in or transferred to such jurisdictions such as Singapore and Malaysia.

Such jurisdictions may not have adequate level of protection for the personal data as will be prescribed by the Personal Data Protection Committee of Thailand. When we do this, we will ensure that the transfer has an appropriate level of protection. For example, your personal data may be shared to Related Corporations in accordance with the relevant laws or other relevant contractual arrangements, which require all CapBay and its Related Corporations to follow the same rules or terms when collecting, using and/or disclosing your personal data.

In some jurisdictions, the law might compel us to share certain personal data, e.g., with tax authorities or National Bank. Even in these cases, we will only share the personal data with people who have the right to see it.

J. Your Rights

If you prefer not to receive a particular type of marketing material from us, please click the “unsubscribe” link in the corresponding emails or contact us via the contact details provided below. Please include your complete name, e-mail address and any other relevant information that may be necessary for us to respond to your request.

You are entitled to request the right to (i) receive your personal data which you provided to us and/or transfer your personal data to another party (unless it is impossible to do so due to the technical circumstances, or we are entitled to legally reject your request), (ii) object the collection, use or disclosure of your personal data for direct marketing purposes , (iii) remove or cease processing of your personal data, (iv) restrict the use of your personal data, (v) access to and request a copy of your personal data, (vi) to lodge a complaint with the Personal Data Protection Committee or their office in the event that we do not comply with the PDPA,(vii) request for disclosure of source of personal data CapBay’s obtained from other sources not directly from you, and/or (viii) make corrections, update or deletion of, limit the processing of, make any enquiries or complaints in respect of, and/or withdraw consents which you have provided (including personal data relating to other persons who may be identified from that personal data), by contacting us at:

In relation to either a data access or data correction request, you should quote your name, address and phone/account number and provide brief details of the information you want a copy of or, as the case may be, you want to have corrected, in any such request. Please note that we may decline to comply with your data access request in certain situations, for example when we are unable to confirm your identity or where information requested for is of a confidential commercial nature or if we receive repeated requests from you for access to the same information which burden or expense of providing access is disproportionate to the risks to your privacy. We may also decline to comply with your data correction request in certain situations, for example when you have not supplied us with such information as we may reasonably require to ascertain in what way the personal data to which the data correction request relates is inaccurate, incomplete, misleading or not up-to-date. Nevertheless, we will notify you of the reasons for not being able to accede to your data access and/or data correction requests. We shall be entitled to charge a fee (where permitted under the applicable law) for any data access request.

K. Personal Data of Minor, Incompetent or Quasi-incompetent Persons

Our Site, Platform and our services are not intended for use by or directed to minors, the incompetent or quasi-incompetent persons. We do not knowingly collect, request, use or disclose information from minors, the incompetent or quasi-incompetent persons, unless we obtain consent from the guardian, nor do we knowingly allow minors, the incompetent or quasi- incompetent persons to use our services. By providing information to us, you represent that you are of legal age and competent to agree to these terms. If you believe you may have provided us with a minor’s, the incompetent or quasi-incompetent person’s information without permission from their parent(s) or legal guardian(s), please contact us using the contact details above.

L. Changes to the PDP Notice

We may update this PDP Notice at any time by publishing the updated version on our Site and shall apply and supersede any and all previous versions, including, leaflets and hard copy versions. You are encouraged to check the Platforms and Site and re-visit this PDP Notice periodically for our most up-to-date PDP Notice. Your continued visit to our Site, continued usage of our services and/or continued relationship with us shall be deemed as acceptance of any updates made to our PDP Notice. All communications, transactions and dealings with us shall be subject to the latest version of this PDP Notice in force at the time.

M. Cookies Policy

As part of the data collection process, CapBay may use Cookies and any other similar technologies to collect your information through our Site as part of further improving our Site and your experience in using our Site.

Use of Cookies for Collection of Data 

• What are Cookies?
  Cookies are a type of file in the form of text. Cookies are created by the server when the user accesses the website and the server records it in your browser. The content of such Cookies are reviewable and readable by the server that creates such Cookies and such content shall be returned to the website in each access. The Cookies consist of identifiable information, website name, numbers and letters which collect information about your behaviour and preferred selection performing in the browser.
  Most of the browsers support Cookies, however, you can adjust the setting of the browser to stop the use of cookies or the sending of information of some types of Cookies and/or deleting information contained in the Cookies any time.
• Why are Cookies used?
  We use cookies for number of purposes, including but not limited to, storing your preference for certain types of information or products, for further analysis to provide products and services to you, to improve our products and/or to personalize our services to you. Please refer to your browser documentation to check if the tracking tools have been enabled on your computer and/or mobile device or to disable cookies if you do not wish to have information collected via the use of cookies. You have the choice, at any time, not to provide your Personal Data to us, however failure to provide your Personal Data to us may result in CapBay being unable to provide you with our products and services.